39 ms·

Priority Queue on Ethereum with a 15 ETH Bug Bounty

127 points by HugoMelo 8y ago

40acres 8y ago
Wow, great write up. Excellent example of computer science fundamentals being used to tackle a novel problem. I recently had to use the concept of table doubling to improve a system where rough estimation was being used to determine the size of a data structure. It certainly felt good to recall the concept of table doubling and design a system using it's concepts.
- zmitton 8y ago
  Thanks, I basically did a brain dump on the README. I plan do do many more bounties like it in the future. Really glad it's made some traction.
robertAngst 8y ago
The flaws of ETH seem to show daily. The fact that this is a necessity to keep ETH flowing is a bad sign of things to come. Bitcoin not blockchain.
- arcticbull 8y ago
  Or neither Bitcoin nor Blockchain. The thing is, inflation is actually what keeps the entire economy moving. Deflationary currencies actively dissuade investment and lending. What would a loan even look like denominated in a deflationary currency? Lenders are incentivized not to give you the one, as their cash reserves appreciate risk-free. Oh, and also, why trust this random ad-hoc group of self-appointed economists (the core dev team) over a selected group of professional economists with degrees an arms-length away from politics (the federal reserve)? None of it makes sense. If the core team wants to create more bitcoin they can. Just like the fed. Inflation is not a bad thing - it's solely a regular haircut for unproductive capital. Nobody should be hoarding cash. They should invest. Salaries are indexed for inflation so they don't go down. This isn't rocket science.
  - zmitton 8y ago
    Your economics are all wrong. Ever heard of the Cantillon Effect? https://www.aier.org/article/sound-money-project/cantillon-effects-and-money-neutrality https://www.aier.org/article/sound-money-project/cantillon-e...
    - arcticbull 8y ago
      Your article seems to be making a distinction between the Cantillon effects and Money Neutrality. "In principle, it could be argued that Cantillon Effects focus on the short-term effect of changes in money supply, but that money neutrality is a long term characteristic of money. Short-run effects in resource allocation are typically not denied, usually due to the fact that they alter “sticky” prices, such as wages." It then goes on to argue that Money Neutrality shouldn't be taken as a given. I don't think the article states money neutrality is fallacious, though, and I couldn't find any substantiating claims within it. I suppose the argument I am making is for money neutrality. That yes, the initial recipients of capital are temporarily advantaged being able to purchase assets are pre-inflation prices. However, over time, this does balance out. The market makes it so. I'm not sure, maybe I'm missing something? I'd love to read more on this if you think I am. That said Bitcoin has a worse Gini ratio than any banana republic, worse wealth distribution and all sorts of other economic factors, and an unbounded cost to transact that as a fixed fee unfairly burdens the poor -- that just make it worse all around than the existing USD based financial system.
    - runeks 8y ago
      > The Cantillon Effect refers to the change in relative prices resulting from a change in money supply. The change in relative prices occurs because the change in money supply has a specific injection point and therefore a specific flow path through the economy. The first recipient of the new supply of money is in the convenient position of being able to spend extra dollars before prices have increased. But whoever is last in line receives his share of new dollars after prices have increased. This theory is fundamentally flawed, because it assumes that whoever receives the “new money” buys consumer goods. If this is indeed what happens, then prices should increase. But what if he buys bonds? If newly produced money is used, not to buy consumer goods (or commodities), but bonds, then the injection of new money into the economy has the opposite effect on the price level, because the new money is used to improve the efficiency of production. E.g. if a producer of chickens sells a $250m bond (bought with “new money”) and invests the proceeds in a chicken plant[1], the price of chickens will decrease, due to increased productivity of producing chickens. In the above scenario, the only price that will increase is the price of bonds, which is the same as a falling rate of interest (the rate of interest is inversely proportional to the price of the bond). And this is exactly what has been happening for the past 35 years or so[2]. [1] https://markets.businessinsider.com/news/stocks/costco-plans-to-keep-rotisserie-chicken-at-5-dollars-2018-9-1027555791 https://markets.businessinsider.com/news/stocks/costco-plans... [2] https://awealthofcommonsense.com/wp-content/uploads/2015/12/Screen-Shot-2015-12-16-at-3.26.43-PM.png https://awealthofcommonsense.com/wp-content/uploads/2015/12/...
- amingilani 8y ago
  I don't understand how the fact that the author solved a novel problem and then posted a bounty points to "flaws of ETH". Could you elaborate? Also, what do you mean by "Bitcoin not blockchain"?
- tree_of_item 8y ago
  The fact that what is a necessity? New data structures? Why wouldn't you expect new data structures in absolutely any new environment?
- joshschreuder 8y ago
  What about open-mindedness, not maximalism
seibelj 8y ago
Cryptocurrencies, and especially Ethereum, are truly novel innovations in computer science that cross many academic disciplines. The linked example is a great write-up. It’s sad that there is a vocal group, especially on HN, that knee-jerk hates everything blockchain related and wishes with their entire being for it to fail. However, I think smart contracts are fascinating and wish more people would keep an open mind.
- tdb7893 8y ago
  I personally thought I had an open mind about it but it keeps over promising and under delivering (the most extreme example is the rhetoric surrounding the DAO on the ethereum platform). It's undoubtedly a cool technology but at a certain point it's hard to muster any excitement anymore.
  - nowarninglabel 8y ago
    That's true of just about any technological innovation though. Even look at recent examples with space, self-driving cars, etc. I'd posture that we are currently somewhere in the Trough of Disillusionment [0] and that it'll another year or two before there's more mass use/adoption. [0] https://en.wikipedia.org/wiki/Hype_cycle https://en.wikipedia.org/wiki/Hype_cycle
    - lifthrasiir 8y ago
      Hype cycle suffers from a survivor bias. You cannot use hype cycle to determine if the "innovation" will be eventually successful, as failed "innovations" may also follow the first half of the hype cycle and then fall off.
- elvinyung 8y ago
  I definitely agree with you about the anti-blockchain bubble that's formed, but I think that there are a few unanswered questions about non-technological factors (shameless self-promotion: [1]) that will unfortunately limit them to be little more than interesting technologies for now. [1] https://www.notion.so/Yet-Another-Rant-About-Blockchains-ece6657d0a3b491bb39dd8002055a5af https://www.notion.so/Yet-Another-Rant-About-Blockchains-ece...
zmitton 8y ago
by the way. I deployed the same thing on the KOVAN test network at this address (if people want to test their exploits for free first): https://kovan.etherscan.io/address/0xfbc23099a8bd0ce4227920dc559fcfe9c7fa3ce3 https://kovan.etherscan.io/address/0xfbc23099a8bd0ce4227920d...
- runeks 8y ago
  > […] if people want to test their exploits for free first […] This sounds like a bad idea, since it would allow other people to extract the script and put it inside a transaction that’s published on the real network, thus unfairly claiming the bounty.
nodesocket 8y ago
Code bounties are a great use-case for cryptocurrency. I wonder if gratipay[1] for example was built exclusively using BitCoin or Ethereum if it could have survived? [1] https://gratipay.com https://gratipay.com
liorn 8y ago
If I were a malicious actor with a good way to attack this, I would wait until this was being used in real applications which deal with larger amounts of ETH, and then attack. Why should I reveal my cards for $3K?
- albinowax_ 8y ago
  Bug bounties aren't aimed at malicious actors, or an attempt to outbid the black market. There's a lot of non malicious people out there who are still competent hackers.
- michaelt 8y ago
  Because you know if you can find a given flaw, someone else can; and whoever attacks second gets nothing.

127 points by HugoMelo 8y ago

Wow, great write up. Excellent example of computer science fundamentals being used to tackle a novel problem. I recently had to use the concept of table doubling to improve a system where rough estimation was being used to determine the size of a data structure. It certainly felt good to recall the concept of table doubling and design a system using it's concepts.

zmitton 8y ago
Thanks, I basically did a brain dump on the README. I plan do do many more bounties like it in the future. Really glad it's made some traction.

robertAngst 8y ago

The flaws of ETH seem to show daily. The fact that this is a necessity to keep ETH flowing is a bad sign of things to come. Bitcoin not blockchain.

arcticbull 8y ago
Or neither Bitcoin nor Blockchain. The thing is, inflation is actually what keeps the entire economy moving. Deflationary currencies actively dissuade investment and lending. What would a loan even look like denominated in a deflationary currency? Lenders are incentivized not to give you the one, as their cash reserves appreciate risk-free. Oh, and also, why trust this random ad-hoc group of self-appointed economists (the core dev team) over a selected group of professional economists with degrees an arms-length away from politics (the federal reserve)? None of it makes sense. If the core team wants to create more bitcoin they can. Just like the fed. Inflation is not a bad thing - it's solely a regular haircut for unproductive capital. Nobody should be hoarding cash. They should invest. Salaries are indexed for inflation so they don't go down. This isn't rocket science.
- zmitton 8y ago
  Your economics are all wrong. Ever heard of the Cantillon Effect? https://www.aier.org/article/sound-money-project/cantillon-effects-and-money-neutrality https://www.aier.org/article/sound-money-project/cantillon-e...
  - arcticbull 8y ago
    Your article seems to be making a distinction between the Cantillon effects and Money Neutrality. "In principle, it could be argued that Cantillon Effects focus on the short-term effect of changes in money supply, but that money neutrality is a long term characteristic of money. Short-run effects in resource allocation are typically not denied, usually due to the fact that they alter “sticky” prices, such as wages." It then goes on to argue that Money Neutrality shouldn't be taken as a given. I don't think the article states money neutrality is fallacious, though, and I couldn't find any substantiating claims within it. I suppose the argument I am making is for money neutrality. That yes, the initial recipients of capital are temporarily advantaged being able to purchase assets are pre-inflation prices. However, over time, this does balance out. The market makes it so. I'm not sure, maybe I'm missing something? I'd love to read more on this if you think I am. That said Bitcoin has a worse Gini ratio than any banana republic, worse wealth distribution and all sorts of other economic factors, and an unbounded cost to transact that as a fixed fee unfairly burdens the poor -- that just make it worse all around than the existing USD based financial system.
  - runeks 8y ago
    > The Cantillon Effect refers to the change in relative prices resulting from a change in money supply. The change in relative prices occurs because the change in money supply has a specific injection point and therefore a specific flow path through the economy. The first recipient of the new supply of money is in the convenient position of being able to spend extra dollars before prices have increased. But whoever is last in line receives his share of new dollars after prices have increased. This theory is fundamentally flawed, because it assumes that whoever receives the “new money” buys consumer goods. If this is indeed what happens, then prices should increase. But what if he buys bonds? If newly produced money is used, not to buy consumer goods (or commodities), but bonds, then the injection of new money into the economy has the opposite effect on the price level, because the new money is used to improve the efficiency of production. E.g. if a producer of chickens sells a $250m bond (bought with “new money”) and invests the proceeds in a chicken plant[1], the price of chickens will decrease, due to increased productivity of producing chickens. In the above scenario, the only price that will increase is the price of bonds, which is the same as a falling rate of interest (the rate of interest is inversely proportional to the price of the bond). And this is exactly what has been happening for the past 35 years or so[2]. [1] https://markets.businessinsider.com/news/stocks/costco-plans-to-keep-rotisserie-chicken-at-5-dollars-2018-9-1027555791 https://markets.businessinsider.com/news/stocks/costco-plans... [2] https://awealthofcommonsense.com/wp-content/uploads/2015/12/Screen-Shot-2015-12-16-at-3.26.43-PM.png https://awealthofcommonsense.com/wp-content/uploads/2015/12/...
amingilani 8y ago
I don't understand how the fact that the author solved a novel problem and then posted a bounty points to "flaws of ETH". Could you elaborate? Also, what do you mean by "Bitcoin not blockchain"?
tree_of_item 8y ago
The fact that what is a necessity? New data structures? Why wouldn't you expect new data structures in absolutely any new environment?
joshschreuder 8y ago
What about open-mindedness, not maximalism

seibelj 8y ago

Cryptocurrencies, and especially Ethereum, are truly novel innovations in computer science that cross many academic disciplines. The linked example is a great write-up. It’s sad that there is a vocal group, especially on HN, that knee-jerk hates everything blockchain related and wishes with their entire being for it to fail. However, I think smart contracts are fascinating and wish more people would keep an open mind.

tdb7893 8y ago
I personally thought I had an open mind about it but it keeps over promising and under delivering (the most extreme example is the rhetoric surrounding the DAO on the ethereum platform). It's undoubtedly a cool technology but at a certain point it's hard to muster any excitement anymore.
- nowarninglabel 8y ago
  That's true of just about any technological innovation though. Even look at recent examples with space, self-driving cars, etc. I'd posture that we are currently somewhere in the Trough of Disillusionment [0] and that it'll another year or two before there's more mass use/adoption. [0] https://en.wikipedia.org/wiki/Hype_cycle https://en.wikipedia.org/wiki/Hype_cycle
  - lifthrasiir 8y ago
    Hype cycle suffers from a survivor bias. You cannot use hype cycle to determine if the "innovation" will be eventually successful, as failed "innovations" may also follow the first half of the hype cycle and then fall off.
elvinyung 8y ago
I definitely agree with you about the anti-blockchain bubble that's formed, but I think that there are a few unanswered questions about non-technological factors (shameless self-promotion: [1]) that will unfortunately limit them to be little more than interesting technologies for now. [1] https://www.notion.so/Yet-Another-Rant-About-Blockchains-ece6657d0a3b491bb39dd8002055a5af https://www.notion.so/Yet-Another-Rant-About-Blockchains-ece...

zmitton 8y ago

by the way. I deployed the same thing on the KOVAN test network at this address (if people want to test their exploits for free first): https://kovan.etherscan.io/address/0xfbc23099a8bd0ce4227920dc559fcfe9c7fa3ce3 https://kovan.etherscan.io/address/0xfbc23099a8bd0ce4227920d...

runeks 8y ago
> […] if people want to test their exploits for free first […] This sounds like a bad idea, since it would allow other people to extract the script and put it inside a transaction that’s published on the real network, thus unfairly claiming the bounty.

nodesocket 8y ago

Code bounties are a great use-case for cryptocurrency. I wonder if gratipay[1] for example was built exclusively using BitCoin or Ethereum if it could have survived? [1] https://gratipay.com https://gratipay.com

liorn 8y ago

If I were a malicious actor with a good way to attack this, I would wait until this was being used in real applications which deal with larger amounts of ETH, and then attack. Why should I reveal my cards for $3K?

albinowax_ 8y ago
Bug bounties aren't aimed at malicious actors, or an attempt to outbid the black market. There's a lot of non malicious people out there who are still competent hackers.
michaelt 8y ago
Because you know if you can find a given flaw, someone else can; and whoever attacks second gets nothing.